feat(export): extend --redact-secrets coverage for application keys#46
Open
hugomelendez wants to merge 1 commit into
Open
feat(export): extend --redact-secrets coverage for application keys#46hugomelendez wants to merge 1 commit into
hugomelendez wants to merge 1 commit into
Conversation
Add provider_verification_key, client_id, and app_id redaction; strip embedded credentials from OIDC issuer URLs while keeping host/path visible; fail export when cleartext remains after redaction. Preserve auth_* proxy flags and document the contract in README and TC-EXP-003. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
Extend
--redact-secretsto close credential gaps in shared exports: redactprovider_verification_key,client_id, andapp_id; strip embedded credentials from OIDC issuer URLs while keeping host/path visible; fail export when cleartext remains after redaction.Type of change
RHCL checklist
go test ./...)-DskipTestswithout justificationTest plan
go test ./internal/export/...go test ./...(coverage 80.7%)TestExportRedactSecrets— extended keys, issuer strip, auth flags preservedTestExportWithoutRedactPreservesSecrets— opt-in default (no flag)TestVerifyNoCleartextSecretsFailsWithPath— gate fails with path-qualified errorAdditional information
extend-redact-secrets